CVE-2022-42964 MEDIUM

CVE-2022-42964: Exponential ReDoS in pymatgen leads to denial of service

Vendor Pymatgen
Product pymatgen
Weakness CWE-1333
Published November 9, 2022
Last update May 1, 2025
View on NVD All CVEs

CVSS base score

5.9/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the pymatgen PyPI package, when an attacker is able to supply arbitrary input to the GaussianInput.from_string method

Key dates

02Disclosure timeline

November 9, 2022 CVE published
May 1, 2025 Record updated